nerdexam
EC-Council

312-50V11 · Question #18

What is attempting an injection attack on a web server based on responses to True/False questions called?

The correct answer is C. Blind SQLi. Blind SQL injection infers database information indirectly by observing True/False application responses rather than viewing direct query output.

SQL Injection

Question

What is attempting an injection attack on a web server based on responses to True/False questions called?

Options

  • ADMS-specific SQLi
  • BCompound SQLi
  • CBlind SQLi
  • DClassic SQLi

How the community answered

(51 responses)
  • A
    2% (1)
  • B
    4% (2)
  • C
    92% (47)
  • D
    2% (1)

Why each option

Blind SQL injection infers database information indirectly by observing True/False application responses rather than viewing direct query output.

ADMS-specific SQLi

DBMS-specific SQLi exploits syntax or functions unique to a particular database engine such as MySQL or MSSQL, which is unrelated to whether the attacker can observe direct output.

BCompound SQLi

Compound SQLi refers to chaining multiple attack techniques together such as combining SQLi with other exploit types, not a method based on true/false inference.

CBlind SQLiCorrect

Blind SQL injection is used when an application does not return query results directly in the HTTP response, forcing the attacker to ask the database true/false questions (Boolean-based blind) or trigger time delays (time-based blind) to extract data one bit at a time. The defining characteristic is inferring information from indirect behavioral responses rather than reading data directly from the page.

DClassic SQLi

Classic (in-band) SQLi returns data directly within the application's HTTP response, which is the opposite of the indirect inference technique described in the question.

Concept tested: Blind SQL injection Boolean-based inference technique

Source: https://owasp.org/www-community/attacks/Blind_SQL_Injection

Topics

#blind SQL injection#boolean-based SQLi#true/false inference#SQL injection types

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice